My Security Planet » Tags

66 items tagged "Uncategorized"

Mozilla Webdev

Enter the LizardFeeder

Posted: January 7th, 2009, 4:09pm CST by lorchard

Enclosure: [download]

Tags: Uncategorized [edit]

The Mozilla Tree

(Be sure to check out
the large version.)

For the punchline first, go check out what just went live at feeds.mozilla.com. The rest of this entry is the back-story.

You see, behind Firefox is Mozilla, and behind Mozilla is a community. And the Mozilla community acts a lot like an ecosystem, which can be visualized as a kind of living tree—not to confused with the mozilla-central tree. Oh yeah, and Mozilla is the name of both a Foundation and a Corporation.

Confused yet? If not, then we should talk so you can explain it, because it all looks pretty tangly and intertwingled to me. Nonetheless, it seems to work, and produces a good chunk of my favorite software and technologies.

There are many efforts to track what’s going on—including planets and newsletters and bugzillas and wikis and repositories and tinderboxen. Some of these resources report on, or are driven by, the activity occurring in the others. Some are automated, and others are carefully stitched together by hand. None offer a full picture of what’s going on in the Mozilla galaxy in a way that’s casually comprehensible by a sane human being.

Of course, that’s not a slight against any of these sites or the people maintaining them—extracting an overview from such an organic phenomenon is neither easy nor straightforward. But, it might be fun to try.

As an infovore and avid practitioner of continuous partial attention, my first impulse is to reach for a firehose and stick my head into the stream. Relax, defocus, and try to let my pattern recognizers do their thing—sometimes those pattern recognizers are in my head, and sometimes they’re written in Python.

Firefox Victory!

(Yes, I just wanted
to put a robot here.)

But, for Mozilla, I couldn’t find a stream of sufficient volume or completeness to satisfy me or my robots. Happily, though, my feeding urge found itself aligned with a project to discover the patterns of contribution in the Mozilla community and to find a way to thank the contributors responsible.

So, while we’re still working on the thank-you angle, allow me to introduce you to the Lizardfeeder. The LizardFeeder is a feed aggregator, whose source code is built atop Sam Ruby’s Planet Venus.

The LizardFeeder pulls together and archives activity streams from a wide variety of Mozilla community sources. Beyond the usual human-readable pages produced by a blog-gathering Planet, the LizardFeeder accumulates statistical and historical data meant for consumption and analysis by robots.

At present, the only robot navigating the LizardFeeder archives is an AJAX-ified user interface that animates the firehose as a near real-time or time-lapsed stream of events scrolling by.

This is just meant as a conversation starter, though. I’m hoping to gather feedback and find more sources, as well as to entice creative community members to come up with more sophisticated visualizations of this data.

So, take a look, check it out, and let us know what you think!

busin3ss.name

[YACG] Mass Installer Affiliate Program

Posted: December 2nd, 2008, 6:17pm CST by busin3ss

Tags: Uncategorized [edit]

I’ve just added an affiliate program to [YACG] Mass Installer. To get started, go here and get your link.

Whenever somebody buys [YACG] Mass Installer using your link you will get $27 dollars into your Paypal account! We will process all payments each 15 days, no delays whatsoever. It couldn’t get any easier than this

For those cheap ones out there… Yes, you can use this link to buy a copy for yourself.

If your going to do some heavy promotion, ping me at busin3ss [at] gmail [dot] com and we might be able to work out a better deal for you.
Incentivised CPA offer with a Wordpress plugin

Posted: November 27th, 2008, 1:16pm CST by busin3ss

Tags: Uncategorized [edit]

This is pretty amazing so I had to blog about it. Read the article about incentivised cpa offers over here and grab the Wordpress plugin here.

Props to Brad for releasing such an amazing plugin for free.
WordPress 2.6.5

Posted: November 25th, 2008, 5:29pm CST by busin3ss

Tags: Uncategorized [edit]

The security issue is an XSS exploit discovered by Jeremias Reith that fortunately only affects IP-based virtual servers running on Apache 2.x.

You should always keep your webapp up-to-date. You don’t want to wake up one morning just to find your site full of pharma spam and hidden links, do you? That would be awful

See the full annoucement here and upgrade your Wordpress blog.
Neat templates for your generated sites :)

Posted: November 24th, 2008, 6:36pm CST by busin3ss

Tags: Uncategorized [edit]

You should go to [getyacg.com] if you are interested on getting these templates
[YACG] Mass Installer 1.6 and [YACG] 3.5

Posted: November 24th, 2008, 6:11pm CST by busin3ss

Tags: Uncategorized [edit]
The ultimate tool to create massive amounts of ready to be monetized sites from the ground up! From keyword research to template generation… [YACG] Mass Installer got you covered.

The best website/content generator out there has got even better with this new release. Here is a small excerpt from the changelog from [YACG] and [YACG] Mass Installer:
- New clickbank hook
- Fixed Peakclick and UMAX hooks
- Sitemap is now paginated
- Improved the bookmarking hook(easier to use and much prettier now)
- New video hook. Supports vimeo, flickr, bliptv, viddler and youtube
- Url structure now is more wordpress-like
- New wordpress-like archives(by month)
- New Photobucket hook
- New blogsearch hook
What are you waiting for? Grab your copy at [yacgmassinstaller.com] or take a look at the demo at [demo.yacgmassinstaller.com]
Free [YACG] Mass Installer copies!

Posted: November 19th, 2008, 11:18pm CST by busin3ss

Tags: Uncategorized [edit]

Do you have a blog/forum/mailing list? Do you want to do a review of [YACG] Mass Installer? Then you just won a free copy!

Send me an email at busin3ss [at] gmail [dot] com if you’re interested, and I’ll hook you up with a pre-release version of [YACG] that includes a lot of sweet things.

If you don’t know yet what is [YACG] Mass Installer then you’re lost, you should go ahead asap and take a look at the sales pages and the demos.

Billy (BK) Rios

Pwnichiwa from PacSec!

Posted: November 19th, 2008, 2:28am CST by xssniper

Tags: Uncategorized [edit]

WOW, it’s been a busy couple of weeks! I was in Tokyo last week for PacSec. PacSec was a great time, there were some GREAT talks, and Dragos knows how to party! I co-presented a talk entitled “Cross-Domain Leakiness: Divulging Sensitive Information and Attacking SSL Sessions” with Chris Evans from Google. I’m curious if this was the first time in history a Google Guy and a Microsoft Guy got on stage together and talked about security… Anyway, you can find the slides here:

Chris is a super smart guy and demo’d a ton of browser bugs, most of which he will eventually discuss on his blog (which you should check out). I had a chance to demo a few bugs and went over some techniques to steal Secure Cookies over SSL connections for popular sites. Now, before I get into the details of the Safari File Stealing bug that was recently patched (provided in the next post) I did want to talk a bit about WebKit.

<WARNING Non-Technical Content Follows!>

You were warned! Some friends and I have been playing around with Safari (we’ve got a couple bugs in the pipeline). As everyone knows, Safari is based on the WebKit browser engine. I think WebKit is a great browser engine and apparently so does Google because they use it for their Google Chrome. So, once I discover and report a vulnerability in Safari for the Windows, Apple must also check Safari for Mac, and Safari Mobile for iPhone. Additionally, “someone” should probably let Google know as their Chrome browser also takes a dependency on WebKit. Now, who is this “someone”? Is it the researcher? Is it Apple? Does the researcher have a responsibility to check to ensure this vulnerability doesn’t affect Chrome? Does Apple have a responsibility to give Google the details of a vulnerability reported to them? Our situation works today because we’ve got great people working for Apple and Google (like Aaron and Chris) who have the means to cooperate and work for the greater good. However, as security moves higher and higher on the marketing scorecards and becomes more and more of a “competitive advantage” at what point will goodwill stop and the business sense take over?

Let’s contemplate a scenario that isn’t so black and white… Let’s say two vendors both take a dependency on WebKit. An issue is discovered, but the differences in the two browsers make it so that the implementation for the fix is different. Vendor A has a patch ready to go, Vendor B on the other hand has a more extensive problem and needs a few more days/weeks/months. Should Vendor A wait for Vendor B to complete their patch process before protecting their own customers and pushing patches for their own products?

Let’s flip the scenario… Let’s say Vendor A has a vulnerability reported to them. Vendor A determines that the issue is actually in WebKit. Vendor A contacts Vendor B and discovers that Vendor B isn’t affected… does this mean Vendor B knew about issue, fixed the issue, and didn’t tell Vendor A? Do they have a responsibility to?
House Keeping

Posted: October 22nd, 2008, 2:49am CDT by xssniper

Tags: Uncategorized [edit]

It’s been a crazy couple weeks! Some quick housekeeping:

ChicagoCon – I’ll be in Chi-Town next week giving one of the Keynotes at ChicagoCon. If you’re going to be in the area, hit me up and we’ll grab a few drinks.

Bluehat - I’m glad to see all the young blood in the scene. It’s going to be scary to see what Kuza55 and Sirdarckcat are up to in 10/15 years (they’re already tearing stuff up as it is…). As for us old guys, we can’t drink like we used too… but we still try :) As usual, the Bluehat parties ROCKED and it was great meeting everyone. We topped off all the Bluehat debauchery with a night at the shooting range, shooting AR-15s and various handguns…

MBA - I actually took a Midterm during the WAF discussion panel at Bluehat (no wonder I was soooo quiet). Once this class is over, I’ll have 3 more classes to go and I’ll have completed my MBA! The coursework isn’t too bad, but the time commitment is pretty high. It definitely cuts into my “pwnage time” and I can’t wait till it’s all over. Don’t ask me why I need another Masters degree and don’t ask me how many times I’ve XSS’d my online class discussion forums. I promise to practice responsible disclosure after my classes are over… but for now, its the only thing that keeps class bearable

Grey Goose - This was an AWESOME project and I’m glad Jeff Carr asked me to participate. Jeff basically assembled enough Intel brain power to rival an Intel agency of a small country. Jeff put out a couple reports and if you need more info on the project, you can find it here. I studied warfare as an Officer in the Marine Corps (Maneuver and Expeditionary) and I’m interested in anything related to cyber warfare. We’re living in a time when the tactical, operational, and strategic thinking surrounding cyber warfare is being defined. We can already see striking similarities between cyber capabilities and air power. Just as air power added a new dimension to modern warfare, so do cyber capabilities. Many typically view Computer Network Attack (CNA) and Computer Network Exploitation (CNE) as solitary events, but they can also be used in “combined arms” scenarios (much like targeted air strikes vs close air support). One day doctrine related to cyber warfare will be required reading for young military officers, just like Sun-tzu, Clausewitz, and Jomini.

Apple Pwnage – Nitesh and I reported a vulnerability to Apple (CVE-ID: CVE-2008-3638). I’ll go over the details on the blog as soon as some loose ends get tied up.

Win7 – I finally took the advice of Rob Hensing and Dave Weston and switched to Win7 as my primary OS…. So far, it absolutely ROCKS.

Great talk by a respected haxor…. – [video.google.com]

busin3ss.name

easyComment Firefox Extension

Posted: October 10th, 2008, 12:20am CDT by busin3ss

Tags: Uncategorized [edit]

My friend beni just released a nifty and free Mozilla Firefox extension that atomates the tedious task of posting comments on Wordpress blogs. It will automatically find the form and add all the necessary information, so you just have to write the comment.

Check it out here: [blog.bf-itservice.de] (Scroll down to see the english version)
Twitter Contest (3)

Posted: October 7th, 2008, 4:03pm CDT by busin3ss

Tags: Uncategorized [edit]

Want an 80% of discount on the first month and a 25% lifetime discount on [blogfarmexplosion.com]? What about a 50% discount on [YACG] Mass Installer?

Send me a reply at [twitter.com] and if you are between the first ten on doing it, you just won!

First come, first served so hurry!
Twitter Contest (3)

Posted: October 7th, 2008, 4:03pm CDT by busin3ss

Tags: Uncategorized [edit]

Want an 80% of discount on the first month and a 25% lifetime discount on [blogfarmexplosion.com]? What about a 50% discount on [YACG] Mass Installer?

Send me a reply at [twitter.com] and if you are between the first ten on doing it, you just won!

First come, first served so hurry!
Books I’m reading right now

Posted: September 30th, 2008, 4:40pm CDT by busin3ss

Tags: Uncategorized [edit]

Mastering Regular Expressions

RESTful Web Services

Programming Erlang: Software for a Concurrent World
PubCon Coupon

Posted: September 30th, 2008, 2:44pm CDT by busin3ss

Tags: Uncategorized [edit]

Any exhibitor or sponsor out there that could hook me up with a coupon code for Pubcon? (Yes, I’m being cheap!)

I’m planning on attending this year, should be pretty fun! If you are interested in chit-chatting with me over there, send me an email to busin3ss [at] gmail [dot] com…
Twitter Contest (2)

Posted: September 23rd, 2008, 7:40pm CDT by busin3ss

Tags: Uncategorized [edit]

The contest will be held before the end of the month, so make sure you add me to [twitter.com] if you want to participate and win some great discounts for http://blogfarmexplosion.com and http://yacgmassinstaller.com!

There will be other surprises aswell.
Manually Spamming Blogs

Posted: September 23rd, 2008, 7:38pm CDT by busin3ss

Tags: Uncategorized [edit]

Lately I’ve seen a rise of referrers like this on several of my sites:

[20/Sep/2008:07:02:26 -0500] “GET /hotmail-captcha-extraction HTTP/1.1″ 200 11473 “http://www.google.co.in/search?hl=en&q=%2B%22Leave+a+Reply%22+%2B%22Name+(required)%22+%2BEmail+(required)&start=130&sa=N” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)”

You can add all the captchas you want, but you’ll never defeat someone manually spamming your sites
Twitter Contest

Posted: September 21st, 2008, 7:10pm CDT by busin3ss

Tags: Uncategorized [edit]

I’m going to hold a small contest over twitter, over 50% discount on http://blogfarmexplosion.com and http://yacgmassinstaller.com! Make sure you add me [twitter.com] so you’re able to participate

Hotmail Captcha Extraction

Posted: September 2nd, 2008, 8:59pm CDT by busin3ss

Tags: Uncategorized [edit]

Please start by reading this post where I explain everything about this code, thanks!

This is the code for the Hotmail Image Captcha, and the one for the audio captcha is below the jump

    //This script pulls CAPTCHAs from $urlHotmail and saves them to folder $saveHotmail from the range $startImage to $endImage.
        $urlHotmail = "http://hipservice.live.com/hipImageDirect.srf?id=68692&config=Hard8Char&tk=1205287476696";
        $saveHotmail = "hotmail/";
        $startImage = 0;
        $endImage = 999;
 
        //These two lines force the output to be constantly flushed and updated for the user. (ideally)
        ob_implicit_flush(true);
        ob_end_flush();
        echo "Script Started.n";
 
 
        //Pull in the CAPTCHA image as a string with cURL, and save to a file. The curl extension must first be enabled in php.ini.
        for ($i=$startImage;$i<=$endImage;$i++) {
                $ch = curl_init();
                curl_setopt($ch, CURLOPT_URL, $urlHotmail."&rand=".$i);
                curl_setopt($ch, CURLOPT_HEADER, 0);
                curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
                $image = curl_exec($ch);
                curl_close($ch);
 
                //Save CAPTCHA to a file with the same name as $i.
                if(!is_dir($saveHotmail)) mkdir($saveHotmail);
                $fh = fopen($saveHotmail.$i.".jpg","w");
                fwrite($fh,$image);
                fclose($fh);
 
                //Don't allow it to timeout.
                set_time_limit(40);
                //Output occasional progress.
                if ($i%10 == 0) {
                        echo $i." CAPTCHA captured.n";
                        flush();
                }
        }
 
 
        echo "Script Complete.";
        //-maluc

About this captcha:

length: 8
range: A-Z,2-3,5-6,8-9
case-sensitive: no
background: always gray
text color: always dark blue
overlay: short line paths with 0-3 bends, always dark blue
size: 3200-4400 bytes
width: always 218px
height: alway 48px
other: looks easiest to solve, font size varies

Here is the code for the Hotmail Audio Captcha:

    //This script pulls CAPTCHAs URL from $urlHotmailAudio with POST parameters $paramsHotmailAudio, then gets the CAPTCHA and saves them to folder $saveHotmailAudio from the range $startSound to $endSound.
        $urlHotmailAudio = "https://signup.live.com/nexus.fpp?cnmn=Microsoft.Msn.MemberExperience.Nexus.NexusService.GetHipAudioData&ptid=0&a=3ba63739-06f1-491a-9aa3-3f98a343b5d1";
        $paramsHotmailAudio = "cn=Microsoft.Msn.MemberExperience.Nexus.NexusService&mn=GetHipAudioData&d=%22en%22,%223ba63739-06f1-491a-9aa3-3f98a343b5d1%22&v=1";
        $saveHotmailAudio = "hotmailaudio/";
        $startSound = 0;
        $endSound = 999;
 
        //Make carraige returns appear correctly in all browsers. (ideally)
        echo "<PRE>";
        //These two lines force the output to be constantly flushed and updated for the user. (ideally)
        ob_implicit_flush(true);
        ob_end_flush();
        echo "Script Started.n";
 
 
        //Pull in the CAPTCHA image as a string with cURL, and save to a file. The curl extension must first be enabled in php.ini.
        for ($i=$startSound;$i<=$endSound;$i++) {
                //First extract a unique URL for each CAPTCHA from the $urlHotmailAudio.
                $ch = curl_init();
                curl_setopt($ch, CURLOPT_URL, $urlHotmailAudio."&rand=".$i);
                curl_setopt($ch, CURLOPT_POST, 1);
                curl_setopt($ch, CURLOPT_POSTFIELDS, $paramsHotmailAudio);
                curl_setopt($ch, CURLOPT_HEADER, 0);
                curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
                curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
                //If you're having difficulties with SSL, this may need to be enabled.
                //curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
                $result = curl_exec($ch);
                //Enable this if you're having difficulties.
                //echo "Error is: ".curl_error($ch);
                curl_close($ch);
 
                //Parse out the URL, and retrieve the CAPTCHA for it.
                $resultArray = explode('"',$result);
                $ch = curl_init();
                curl_setopt($ch, CURLOPT_URL, $resultArray[5]."&rand=".$i);
                curl_setopt($ch, CURLOPT_HEADER, 0);
                curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
                $sound = curl_exec($ch);
                //Enable this if you're having difficulties.
                //echo "Error is: ".curl_error($ch);
                curl_close($ch);
 
                //Save CAPTCHA to a file with the same name as $i.
                if(!is_dir($saveHotmailAudio)) mkdir($saveHotmailAudio);
                $fh = fopen($saveHotmailAudio.$i.".wav","w");
                fwrite($fh,$sound);
                fclose($fh);
 
                //Don't allow it to timeout.
                set_time_limit(40);
                //Output occasional progress.
                if ($i%10 == 0) {
                        echo $i." CAPTCHA captured.n";
                        flush();
                }
        }
 
 
        echo "Script Complete.";
        //-maluc

And info about the audio captchas as well:

length: 10
range: 0-9
case-sensitive: N/A
background: lower volume gibberish, sounds like numbers really fast with extra noise
size: 46000-131000 bytes
other: numbers seem to follow a steady pace, pitch varies and either a higher pitched woman or low pitched male with robotic senthesizing

Google Captcha Extraction

Posted: September 2nd, 2008, 8:25pm CDT by busin3ss

Tags: Uncategorized [edit]

Please start by reading this post where I explain everything about this code, thanks!

This is the code for the Google Image Captcha, and the one for the audio captcha is below the jump

//This script pulls CAPTCHAs URL from $urlGoogle, then gets the CAPTCHA and saves them to folder $saveGoogle from the range $startImage to $endImage.
        $urlGoogle = "https://www.google.com/accounts/NewAccount?service=mail&amp;continue=http%3A%2F%2Fmail.google.com%2Fmail%2Fe-11-10ba05aeaa8e9b701e5151437f9a44d3-64aeae753cc34f1c864f7edc97a046ccdc96987b&amp;type=2";
        $saveGoogle = "google/";
        $startImage = 0;
        $endImage = 999;
 
        //These two lines force the output to be constantly flushed and updated for the user. (ideally)
        ob_implicit_flush(true);
        ob_end_flush();
        echo "Script Started.n";
 
        //Pull in the CAPTCHA image as a string with cURL, and save to a file. The curl extension must first be enabled in php.ini.
        for ($i=$startImage;$i<=$endImage;$i++) {
                //First extract a unique URL for each CAPTCHA from the $urlGoogle.
                $ch = curl_init();
                curl_setopt($ch, CURLOPT_URL, $urlGoogle."&amp;rand=".$i);
                curl_setopt($ch, CURLOPT_HEADER, 0);
                curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
                curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
                //If you're having difficulties with SSL, this may need to be enabled.
                //curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
                $result = curl_exec($ch);
                //Enable this if you're having difficulties.
                //echo "Error is: ".curl_error($ch);
                curl_close($ch);
 
                //Parse out the URL, and retrieve the CAPTCHA for it.
                $result = substr($result,strpos($result,"gaia captchahtml desc"));
                $resultArray = explode('"',$result);
                $ch = curl_init();
                curl_setopt($ch, CURLOPT_URL, rawurldecode($resultArray[2]));
                curl_setopt($ch, CURLOPT_HEADER, 0);
                curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
                curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
                //If you're having difficulties with SSL, this may need to be enabled.
                //curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
                $image = curl_exec($ch);
                //Enable this if you're having difficulties.
                //echo "Error is: ".curl_error($ch);
                curl_close($ch);
 
                //Save CAPTCHA to a file with the same name as $i.
                if(!is_dir($saveGoogle)) mkdir($saveGoogle);
                $fh = fopen($saveGoogle.$i.".jpg","w");
                fwrite($fh,$image);
                fclose($fh);
 
                //Don't allow it to timeout.
                set_time_limit(40);
                //Output occasional progress.
                if ($i%10 == 0) {
                        echo $i." CAPTCHA captured.n";
                        flush();
                }
        }
 
        echo "Script Complete.";
        //-maluc

About this captcha:

length: 5-8
range: a-z
case-sensitive: no
background: always white
overlay: none
text color: solid blue,green,or red. single color.
size: 2000-3900 bytes
width: always 200px
height: always 70px
other: tilting seemingly random, 5chars is rare, red is rare, shade of solid colors may change between captchas

Here is the code for the Google Audio Captcha:

//This script pulls CAPTCHAs URL from $urlGoogleAudio, then gets the CAPTCHA and saves them to folder $saveGoogleAudio from the range $startSound to $endSound.
        $urlGoogleAudio = "https://www.google.com/accounts/NewAccount?service=mail&amp;continue=http%3A%2F%2Fmail.google.com%2Fmail%2Fe-11-10ba05aeaa8e9b701e5151437f9a44d3-64aeae753cc34f1c864f7edc97a046ccdc96987b&amp;type=2";
        $saveGoogleAudio = "googleaudio/";
        $startSound = 0;
        $endSound = 999;
 
        //These two lines force the output to be constantly flushed and updated for the user. (ideally)
        ob_implicit_flush(true);
        ob_end_flush();
        echo "Script Started.n";
 
        //Pull in the CAPTCHA image as a string with cURL, and save to a file. The curl extension must first be enabled in php.ini.
        for ($i=$startSound;$i<=$endSound;$i++) {
                //First extract a unique URL for each CAPTCHA from the $urlGoogleAudio.
                $ch = curl_init();
                curl_setopt($ch, CURLOPT_URL, $urlGoogleAudio."&amp;rand=".$i);
                curl_setopt($ch, CURLOPT_HEADER, 0);
                curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
                curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
 
                //If you're having difficulties with SSL, this may need to be enabled.
                //curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
                $result = curl_exec($ch);
                //Enable this if you're having difficulties.
                //echo "Error is: ".curl_error($ch);
                curl_close($ch);
 
                //Parse out the URL, and retrieve the CAPTCHA for it.
                $result = substr($result,strpos($result,"wavURL"));
                $resultArray = explode('"',$result);
                $ch = curl_init();
                curl_setopt($ch, CURLOPT_URL, str_replace('75',"=",$resultArray[1]));
                curl_setopt($ch, CURLOPT_HEADER, 0);
                curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
                curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
                //If you're having difficulties with SSL, this may need to be enabled.
                //curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
                $sound = curl_exec($ch);
                //Enable this if you're having difficulties.
                //echo "Error is: ".curl_error($ch);
                curl_close($ch);
 
                //Save CAPTCHA to a file with the same name as $i.
                if(!is_dir($saveGoogleAudio)) mkdir($saveGoogleAudio);
                if(strlen($sound) &gt; 146) {
                        $fh = fopen($saveGoogleAudio.$i.".wav","w");
                        fwrite($fh,$sound);
                        fclose($fh);
                }
                else $i--;
 
                //Don't allow it to timeout.
                set_time_limit(40);
                //Output occasional progress.
                if ($i%10 == 0) {
                        echo $i." CAPTCHA captured.n";
                        flush();
                }
        }
 
        echo "Script Complete.";
        //-maluc

And info about the audio captchas as well:

length: not certain (5-10?)
range: 0-9
case-sensitive: N/A
background: equally loud gibberish and noise, really gets in the way.
size: 200044-440044 bytes
other: way too hard for a human - don’t know how blind people do it. pace varies but pitch seems to remain fairly similar.

Permalink for 'busin3ss.name/2008/09/02/Yahoo__Captcha_Extraction'

For those who are interested in security you should definitely check out sla.ckers.org. I’ve read some real gems over there when related to webapp security and it has inspired me before to write some posts. This time, I found something I just had to share with you guys. Don’t worry, I contacted maluc (the original author of the post) to get permission to post his stuff over here.

When it comes to test a captcha and it’s weakness, you always need to have a large sample to work with. If you’re planning to train or write an OCR engine, it’s always useful and sometimes needed to have several samples to play with.

I’m going to start by posting this code to extract a large sample of Yahoo! captchas:

<?php
//This script pulls CAPTCHAs URL from $urlYahoo, then gets the CAPTCHA and saves them to folder $saveYahoo from the range $startImage to $endImage.
$urlYahoo = "https://edit.yahoo.com/reg_json?PartnerName=yahoo_default&amp;RequestVersion=1&amp;ApiName=GetCaptcha&amp;3841320";
$saveYahoo = "yahoo/";
$startImage = 0;
$endImage = 999;
 
//These two lines force the output to be constantly flushed and updated for the user. (ideally)
ob_implicit_flush(true);
ob_end_flush();
echo "Script Started.n";
 
//Pull in the CAPTCHA image as a string with cURL, and save to a file. The curl extension must first be enabled in php.ini.
for ($i=$startImage;$<=$endImage;$i++) {
//First extract a unique URL for each CAPTCHA from the $urlYahoo.
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $urlYahoo."&amp;rand=".$i);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
//If you're having difficulties with SSL, this may need to be enabled.
//curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
$result = curl_exec($ch);
//Enable this if you're having difficulties.
//echo "Error is: ".curl_error($ch);
curl_close($ch);
 
//Parse out the URL, and retrieve the CAPTCHA for it.
$resultArray = explode('"',$result);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, stripslashes($resultArray[7]));
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
//If you're having difficulties with SSL, this may need to be enabled.
//curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
$image = curl_exec($ch);
//Enable this if you're having difficulties.
//echo "Error is: ".curl_error($ch);
curl_close($ch);
 
//Save CAPTCHA to a file with the same name as $i.
if(!is_dir($saveYahoo)) mkdir($saveYahoo);
$fh = fopen($saveYahoo.$i.".jpg","w");
fwrite($fh,$image);
fclose($fh);
 
//Don't allow it to timeout.
set_time_limit(40);
//Output occasional progress.
if ($i%10 == 0) {
echo $i." CAPTCHA captured.n";
flush();
}
}
 
echo "Script Complete.";
//-maluc
?>

This script will download and save to the /yahoo/ subfolder a sample of 1000 captchas. If you want to get more or less captchas, just edit the $end variable.

He even took some inital anotations for those interested in this particular captcha:

length: 4-6
range: a-z,A-Z,2-8
case-sensitive: no
background: always white
text color: always black
overlay: 1-3 random line paths, always black
size: between 1800 and 3200 bytes
width: always 290px
height: always 80px
other: tilting and bending randomly, 4chars is rare, each letter either 2d sans-serif or 3d serif, some letters not used or in only one case

You can read the original post at sla.ckers.org here. maluc also did the same for the Google and Hotmail captcha’s so be sure to check them out aswell.

Props to maluc one more time

Pay-Per-Install Guide

Posted: September 1st, 2008, 9:52am CDT by busin3ss

Tags: Uncategorized [edit]

I’ve been taking a look at pay-per-install lately, and I found out a guide at [www.pay-per-install.org] (Best pay-per-install forum)

This guide will cover how to get an affiliate and get your first installs using torrents. It’s really really really basic, but it sure will help you if you want to start working with pay-per-install.

Download it!
First one banned from [YACG]/[YACG] Mass Installer

Posted: August 27th, 2008, 4:31pm CDT by busin3ss

Tags: Uncategorized [edit]

It has been more than a year that [getyacg.com] and [forums.getyacg.com] have been online and for the first time I’ve just banned someone. I used to feel proud that my forums where asshole-free, but I guess you can’t expect that on the internet.
Captchas will lead to the creation of A.I. [pic]

Posted: August 26th, 2008, 2:42pm CDT by busin3ss

Tags: Uncategorized [edit]

Found it at [www.wellingtongrey.net]… While at was working at some captcha breaking stuff
Follow me on Twitter.com

Posted: July 30th, 2008, 12:04pm CDT by busin3ss

Tags: Uncategorized [edit]

Another quick post, I will be using Twitter.com regularly from now on.

Make sure to check me out at [twitter.com], I promise it will be interesting.
New template…

Posted: July 30th, 2008, 11:47am CDT by busin3ss

Tags: Uncategorized [edit]

I haven’t taken care of some of my projects in a while, including my blog… So I decided to update everything and try a new template to get things started.

My life is normal again, so expect some cool stuff from me again

Billy (BK) Rios

Married in Maui!

Posted: July 11th, 2008, 7:28pm CDT by xssniper

Tags: Uncategorized [edit]

I’ve been Maui for the last two weeks and it was AWESOME. My girl and I had our wedding ceremony on a beach in Kihei and our reception “upcountry” in Kula. It was great being back on the islands, catching up with friends and family.

For some reason, I feel energized… Maybe it was the Hawaii sun or may all those late night hacking sessions were finally catching up… or maybe I’m just getting old :p … but I feel good now!

I was pretty much offline for the entire time, so if you’ve sent me an email within the past week I’ll eventually catch up on my email and respond, otherwise I’ll SEE YOU IN VEGAS!!!
Clarification for “BK on Safari, hunting Firefox…”

Posted: June 21st, 2008, 10:33pm CDT by xssniper

Tags: Uncategorized [edit]

Is Safari 3.12 affected by the vulnerability you mention in, BK on Safari, hunting Firefox? The “carpet bomb” behavior COULD have been used in conjunction with Firefox to steal user files. This specific scenario has been patched. Can an attacker use other, non-obvious ways to abuse the Safari (3.12)/Firefox interaction to steal files from the local file system? Yes, I know of three separate methods to accomplish this (Firefox 3 lessens the risk). Vendors have been informed and no details will be provided to the public. Don’t ask for additional details, I won’t give them until all this is straightened out.

Whose fault is this? That’s the whole point of the post. We have interaction between different software from different vendors. In isolation, the behaviors that are being abused here are not a high risk. It’s only when you combine the behaviors does it constitute a risk. Who should we blame? I don’t know, I don’t think anyone really knows… lots of people have their opinions though.
3rd Annual Symposium on Information Assurance

Posted: June 14th, 2008, 11:04pm CDT by xssniper

Tags: Uncategorized [edit]

I was recently given the honor of delivering a keynote talk for the 3^rd Annual Symposium on Information Assurance, which was held in conjunction with 11^th Annual New York State Cyber Security Conference. It was a great conference and I want to thank Sanjay Goel for inviting me!

The conference was VERY academic… which I love. Academics present with an eye to the future so I listened as PHD candidates talked about securing nano networks, sensor based wifi networks and a slew of other topics… Academics also seem to have an boldness and fearless approach to the topics they present, which I admire…

While I enjoyed most of the talks I attended, there was one that perked the ears of the blackhat in me. John Crain of ICANN gave a talk on “Securing the Internet Infrastructure: Myths and Truths”. If you don’t know, ICANN basically owns the root DNS servers that the world relies on everyday. He gave a great explanation of how ICANN goes about creating a heterogeneous ecosystem of DNS servers. These DNS servers use multiple versions and types of DNS software, multiple versions and types of operating systems, and even go so far as to use various pieces of hardware and processors. The reasoning behind this logic is… if a vulnerability is discovered in a particular piece of software (or hardware) is discovered, it would only affect a small part of the entire root DNS ecosystem, whose load could be transferred to another. It’s an interesting approach indeed. After the talk, someone asked me why enterprises/corporations don’t adopt a similar strategy. I thought about it some and I don’t think this approach could enterprise environment… here’s why (other than the obvious costs and ungodly administration requirements):

ICANNs interest is primarily based on preventing hackers from modifying a 45k text file (yes the root for the Internet is a ~45k text file). Now, if a hacker happens to break into a root DNS server and modifies the file, ICANN can disable the hacked system, restore the file and go about their business. As long as ICANN has a “good” system up somewhere, they can push all their traffic to that system. Businesses on the other hand, aren’t not primarily interested in preventing the modification of data (not yet at least), they are more interested in preventing the pilfering of data. So if you own a network of a million different configurations, a vulnerability in any one of those configurations could allow an attacker to steal your data. Once the hacker has stolen your data, what does it matter that the 999,999 other systems are unhacked?

This brings up the heart of the argument, should we be worried about our systems being compromised or should we be worried about our data being stolen? These are actually two different problems as I don’t necessarily have to compromise your system to steal your data…

Mozilla Webdev

Webdev Brainstorm

Posted: June 10th, 2008, 6:45pm CDT by morgamic

Tags: Uncategorized [edit]
Last week we had our entire team on-site and had discussions about where we’ve been and where we’re headed. I put together a short presentation about past, present and future then we had a short brainstorm session about “ok, what’s next?”.

We wanted to share all of this with you to invite any additional feedback or ideas for how we can make the Mozilla web better. Below are the notes from our brainstorm session, and I invite you to add to the wiki page or comment here.

Our main questions for the future that we’d like your thoughts on are:
- What would you like to change about our websites?
- How do we encourage more community participation in development?
- Give us a project idea!
Again, check out our brainstorm notes and we’d like to hear from you if you have any ideas to add to this list! Thanks.
AMO 3.4.3 update scheduled for June 5th

Posted: May 23rd, 2008, 7:00pm CDT by Wil Clouser

Tags: Uncategorized [edit]

Due to the holiday on Monday we’re going to delay the AMO 3.4.3 update this week until June 5th.

Aside from some bug and security fixes in this release we’re mainly focusing on search improvements, streamlining the editors’ queue, and making it easier to browse and discover themes.

There are currently 43 bugs targeted for the 3.4.3 update about half of which are fixed and verified. When bugs are resolved you can view the changes on preview.addons.mozilla.org. As always, feel free to send us any feedback you have.

Billy (BK) Rios

Mark Dowd scares me….

Posted: April 16th, 2008, 12:37am CDT by xssniper

Tags: Uncategorized [edit]

If you haven’t heard yet, Mark Dowd chopped up a Flash vulnerability ninja style and released a 25 page whitepaper describing his attack. It’s truly a work of art and can be found here. <pdf>

I’m not even going to attempt to describe any portion of this attack (just thinking about it makes my head hurt), but Thomas Ptacek from Matasano has a great writeup <writeup>

busin3ss.name

BlogFarmExplosion is live!

Posted: April 14th, 2008, 7:49pm CDT by busin3ss

Tags: Uncategorized [edit]

Create hundreds of blogs on hundreds of hosts in minutes!

For those who didn’t knew, I’ve been working for the past couple of months in BlogFarmExplosion. Basically, it’s a linking tool… But at the same time is so much more. There is no point that I explain you all the details about this amazing tool when you can see it with your own eyes.

Check out our screencast, or go to our site for a higher quality screencast with captions.

Billy (BK) Rios

Google XSS

Posted: April 14th, 2008, 1:28am CDT by xssniper

Tags: Uncategorized [edit]

Now, normally when I find an XSS vulnerability on a popular domain I just report it to the appropriate security team and move on, but this one is interesting…

By taking advantage of the content-type returned by spreadsheets.google.com (and a caching flaw on the part of Google), I was able to pull off a full blown XSS against the google.com domain. For those of you who don’t understand what this means, allow me to elaborate. When Google sets their cookie, it is valid for all of their sub domains. So, when you log into gmail (mail.google.com), your gmail cookie is actually valid for code.google.com, docs.google.com, spreadsheets.google.com…and so on. If someone (like me) finds an XSS vulnerability in any one of these sub domains, I’ll be able to hijack your session and access any google service as if I were you.

So, in this instance, I have an XSS on spreadsheets.google.com. With this single XSS, I can read your Gmail, backdoor your source code (code.google.com), steal all your Google Docs, and basically do whatever I want on Google as if I were you! Google’s use of “document.domain=” also make things a little easier to jump from one domain to the next, but that’s another story…

This particular XSS takes advantage of how Internet Explorer determines the content type of the HTTP response being returned by the server. Most would think that explicitly setting the content-type to something that isn’t supposed to be rendered by the browser would easily solve this issue, but it does not. IE isn’t the only browser that will ignore the content-type header in certain circumstances, Firefox, Opera, and Safari will ignore the content-type header as well (in certain circumstances). Security professionals and more importantly developers need to understand the nuances of how the popular web browsers handle various content-type headers, otherwise they may put their web application at risk of XSS. The most comprehensive paper I’ve seen on the subject was written by Blake Frantz of Leviathan. The paper can be found here. It’s a “MUST HAVE” reference for web app security pros. Read it, understand it, protect yourself appropriately or expect others to exploit appropriately…

In this issue, Google set the content-type header for a response which I controlled the content to text/plain. If I can inject what looks like HTML into the first few bytes of the response, I’ll be able to “trick” Internet Explorer into rendering the content as HTML. Luckily for me, I was able to do just that.

I created a spreadsheet on spreadsheets.google.com and for the first cell (A1) I put the following content: “<HTML><body><script>alert(document.cookie)</script></body></HTML>”

I then saved the spreadsheet and generated a link for the spreadsheet to be served as a CSV.

When this option is selected, the contents of the spreadsheet are displayed inline (the content-disposition header was not explicitly set to “attachment”), IE ignores the content-type header, sniffs the content-type from the response, then proceeds to render the response as if it were HTML. At this point, I control the entire HTML being rendered under an xxx.google.com domain.

To be fair, Google included a subtle defense to protect against content-type sniffing (padding the response), but those protection measures failed (with a little prodding by me). The issue is fixed, but if you try to reproduce this issue, you’ll see their defense in play. It a solid defense which shows they understand the nuances of content-type sniffing.

I’ll provide some tips on taking ownership of untrusted content and serving it from your server in a later post, but for now take a look at the paper written by Blake Frantz. I’m sure it will open some eyes…
Insecure Content Ownership

Posted: April 4th, 2008, 3:12am CDT by xssniper

Tags: Uncategorized [edit]

Taking ownership of someone else’s content is always a tricky deal. Nate McFeters and I spoke about some of the issues related to taking “ownership” of someone else’s content last year at Defcon, but we continue to see more and more places willingly accepting third party content and happily serving it from their domain. I came across an interesting cross domain issue based on content ownership that involved Google. Google has fixed the issue, but I thought the issue was interesting so I’ll share the details… but before I do… I wanted to mention the efforts put forth by the Google Security Team (GST). Fixing this issue was not trivial… it involved significant changes as to how content was served from Google servers. Needless to say, the GST moved quickly and the issue was fixed in an amazingly expedient and effective manner… KUDOS to the GST!



On to the issue:
I discovered that users could upload arbitrary files to the code.google.com domain by attaching a file to the “issues” portion of a project. The uploaded file is then served from the code.google.com domain. Normally, these types of attacks would make use of the Flash cross domain policy file and the System.security.loadPolicyFile() API, however due to the unique path of each project, the cross domain capabilities of Flash are very limited in this instance as policy files loaded via loadPolicyFile() are “limited to locations at or below its own level in the server’s hierarchy”.




Flash isn’t the only option here though. Java has a different security policy and uploading a Java class file to the code.google.com domain gives me access to the entire domain, as opposed to only certain folders and sub folders.



Sounds pretty straight forward huh? Well, I ran into some issues as the JVM encodes certain characters in its requests for class files made via the CODE attribute within APPLET tags. After poking around a bit, I realized that requests made via the ARCHIVE would be sent as is, without the encoding of special characters. With this newfound knowledge in hand, I created a JAR file with my class file within it and uploaded it to code.google.com.





Now, the CODE attribute is a required attribute within the APPLET tag, so I specified name of the class file I placed within the JAR file. When the APPLET tag is rendered, the JVM first downloads the JAR file specified in the ARCHIVE attribute, the JVM then makes the request for the class file specified in the CODE attribute. In this instance, the request for the class file specified in the CODE attribute will fail as the class file is not on the code.google.com server (even if it was, we wouldn’t be able to reach it as requests made via the CODE attribute are encoded). The failure to locate the class file causes the JVM to begin searching alternate locations for the requested class file and the JVM will eventually load a class file with the same name located inside of the JAR file…







Once the class file is loaded, the JVM will fire the init() method and Java’s Same Origin policy allows me to use the applet to communicate with the domain that served the applet class file (as opposed to the domain that hosts the HTML calling the APPLET tag). Here’s a screenshot of the PoC page I was hosting on XS-Sniper.com.




I don’t think there is a tool on the market today that even attempts to detect something like this and I’ve met many “security professionals” that have no idea that vulnerabilities like this even exist. This isn’t the first time I’ve come across a cross domain hole based on content ownership. I’m expecting we’ll see a lot more of these types of vulnerabilities in the future as cross domain capabilities becomes more prevalent in client side technologies and as content providers become more and more comfortable in taking ownership of others content.

busin3ss.name

Google Human Reviewer Guidelines (Leaked)

Posted: March 15th, 2008, 11:53pm CDT by busin3ss

Tags: Uncategorized [edit]

When trying to decide if a page is Spam, it is helpful to ask yourself this question: If I remove the scraped (copied) content, the ads, and the links to other pages, is there anything of value left? If the answer is no, the page is probably Spam.

Download it here: quality-rater-guidelines-2007.pdf!

And before you start bitching… This file is everywhere now. At [YACG]’s forum, BlackHatWorld, Syndk8, IranJava…
Google Bowling + DDoS = Pwnage!

Posted: March 15th, 2008, 9:33pm CDT by busin3ss

Tags: Uncategorized [edit]

Guess you all know about the ongoing controversy about someone abusing Eli’s tool QUIT and a DDoS against BlueHatSeo.com. For what I’ve read I think somebody is pissed with Eli because his blog is disclosing too much information (?). Who knows what is the real motive… But this made me realize that no matter how good it seems things are going for your sites and rankings… You can NEVER get to comfy.

I know a DDoS may not seem that bad; Your sites goes offline, you burn all your bandwdith and after a couple of days your back online… right?

Well, maybe.. But what if the perpetrator of the DDoS decides to take it one step further… Like a DDoS + Google Bowling attack:

That’s right, it would be a fatality. A long-lasting DDoS attack and some Google Bowling that results on de-indexing could be the worst nightmare of your site… And if it’s executed correctly, there is no going back for your site… Ever.
Now if you want to make it suck even more, add to it some hacking and some imagination.
Yet another review of [YACG] Mass Installer

Posted: March 11th, 2008, 11:28am CDT by busin3ss

Tags: Uncategorized [edit]

Interesting review, you should check it out if you are interested in buying a copy or two

http://blackhatseodiary.org/black-hat-seo-tools/yacg-mass-installer-is-fucking-great
$200 Post Competition at http://forums.getyacg.com

Posted: March 10th, 2008, 11:17pm CDT by busin3ss

Tags: Uncategorized [edit]
Vladimir and I are hosting a competition at [forums.getyacg.com] for the best post or code contribution.

The competition starts today and will last a whole month (Until April 10). Basically the best post at the forums between those dates will get the grand prize. However, there are some rules:
- It must be an original post, not a repost of an old one. If it’s a code contribution, please make sure you coded it yourself and you are not stealing somebody else work. (Same rules apply to a post!)
- You will get $100 dollars cash via Paypal, a free copy of [YACG] Mass Installer and free ad spot at my blog, [YACG]’s site and [YACG]’s forum.
- The winner will be chosen by the VIP users.
- If you are not a member of the forums, you can send it via email to busin3ss [at] gmail [dot] com
- You can talk about whatever you want as long as it’s related to black hat seo.
Good luck!

My Security Planet » Tags » Uncategorized

Feeds

66 items tagged "Uncategorized"

Posted: January 7th, 2009, 4:09pm CST by lorchard

Enclosure: [download]

Tags: Uncategorized [edit]

Posted: December 2nd, 2008, 6:17pm CST by busin3ss

Tags: Uncategorized [edit]

Posted: November 27th, 2008, 1:16pm CST by busin3ss

Tags: Uncategorized [edit]

Posted: November 25th, 2008, 5:29pm CST by busin3ss

Tags: Uncategorized [edit]

Posted: November 24th, 2008, 6:36pm CST by busin3ss

Tags: Uncategorized [edit]

Posted: November 24th, 2008, 6:11pm CST by busin3ss

Tags: Uncategorized [edit]

Posted: November 19th, 2008, 11:18pm CST by busin3ss

Tags: Uncategorized [edit]

Posted: November 19th, 2008, 2:28am CST by xssniper

Tags: Uncategorized [edit]

Posted: October 22nd, 2008, 2:49am CDT by xssniper

Tags: Uncategorized [edit]

Posted: October 10th, 2008, 12:20am CDT by busin3ss

Tags: Uncategorized [edit]

Posted: October 7th, 2008, 4:03pm CDT by busin3ss

Tags: Uncategorized [edit]

Posted: October 7th, 2008, 4:03pm CDT by busin3ss

Tags: Uncategorized [edit]

Posted: September 30th, 2008, 4:40pm CDT by busin3ss

Tags: Uncategorized [edit]

Posted: September 30th, 2008, 2:44pm CDT by busin3ss

Tags: Uncategorized [edit]

Posted: September 23rd, 2008, 7:40pm CDT by busin3ss

Tags: Uncategorized [edit]

Posted: September 23rd, 2008, 7:38pm CDT by busin3ss

Tags: Uncategorized [edit]

Posted: September 21st, 2008, 7:10pm CDT by busin3ss

Tags: Uncategorized [edit]

Posted: September 2nd, 2008, 8:59pm CDT by busin3ss

Tags: Uncategorized [edit]

Posted: September 2nd, 2008, 8:25pm CDT by busin3ss

Tags: Uncategorized [edit]

Posted: September 2nd, 2008, 8:15pm CDT by busin3ss

Tags: Uncategorized [edit]

Posted: September 1st, 2008, 9:52am CDT by busin3ss

Tags: Uncategorized [edit]

Posted: August 27th, 2008, 4:31pm CDT by busin3ss

Tags: Uncategorized [edit]

Posted: August 26th, 2008, 2:42pm CDT by busin3ss

Tags: Uncategorized [edit]

Posted: July 30th, 2008, 12:04pm CDT by busin3ss

Tags: Uncategorized [edit]

Posted: July 30th, 2008, 11:47am CDT by busin3ss

Tags: Uncategorized [edit]

Posted: July 11th, 2008, 7:28pm CDT by xssniper

Tags: Uncategorized [edit]

Posted: June 21st, 2008, 10:33pm CDT by xssniper

Tags: Uncategorized [edit]

Posted: June 14th, 2008, 11:04pm CDT by xssniper

Tags: Uncategorized [edit]

Posted: June 10th, 2008, 6:45pm CDT by morgamic

Tags: Uncategorized [edit]

Posted: May 23rd, 2008, 7:00pm CDT by Wil Clouser

Tags: Uncategorized [edit]

Posted: April 16th, 2008, 12:37am CDT by xssniper

Tags: Uncategorized [edit]

Posted: April 14th, 2008, 7:49pm CDT by busin3ss

Tags: Uncategorized [edit]

Posted: April 14th, 2008, 1:28am CDT by xssniper

Tags: Uncategorized [edit]

Posted: April 4th, 2008, 3:12am CDT by xssniper

Tags: Uncategorized [edit]

Posted: March 15th, 2008, 11:53pm CDT by busin3ss

Tags: Uncategorized [edit]

Posted: March 15th, 2008, 9:33pm CDT by busin3ss

Tags: Uncategorized [edit]

Posted: March 11th, 2008, 11:28am CDT by busin3ss

Tags: Uncategorized [edit]

Posted: March 10th, 2008, 11:17pm CDT by busin3ss

Tags: Uncategorized [edit]